GitHub Advisoryadvisory · crates.io

GHSA-wwh2-r387-g5rm tower-http's improper validation of Windows paths could lead to directory traversal attack

MEDIUM Published 2022-06-17 Modified 2023-06-13 Official page ↗
Ecosystem
crates.io
Packages
tower-http
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2022-06-17

Affected packages

• crates.io tower-http: >= 0.2.0, < 0.2.1 → fixed in 0.2.1 • crates.io tower-http: < 0.1.3 → fixed in 0.1.3

Description

`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References